03-06-2018 09:41 AM - edited 03-06-2018 09:41 AM
There are a couple things that are incorrect.
The first thing is, you are assuming that a Malicious verdict from WildFire on a file, means instantaneous Antivirus coverage. Once WildFire determines a sample is malicious, it sends it to PAN-AV, which generates a signature for the sample. This signature is then stacked, and is released every 5 minutes. You have to actually fetch the WildFire-Virus database to the firewall through Dynamic Updates for it to have the signature to detect files matching its pattern.
The second thing, is you are assuming WildFire would create an AV signature for the WildFire PE file, and that's not true. The WildFire PE file is only meant to test the WildFire forwarding (uploading sample to WildFire) and receiving back a report from WildFire, but it does not send the WildFire PE file to PAN-AV, so a signature is never generated for it.
